GHSA-7336-ghhp-f2qj Shopware Remote Code Execution Vulnerability
Attackers can execute arbitrary code in Shopware if custom templates improperly handle field data, requiring a patch to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7336-ghhp-f2qj?
GHSA-7336-ghhp-f2qj is a code injection vulnerability in shopware/shopware, published on 21 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware in versions prior to 5.2.16. One possible threat is if a template that doesn’t derive from the Shopware standard has been completely copied. Themes or plugins that execute or overwrite the following template code are vulnerable.
- Affected file: emotion.tpl
Path template file "Emotion template": templates / _default / frontend / forms / elements.tpl Path template file "Responsive template": themes/Frontend/Bare/frontend/forms/elements.tpl
The complete line beginning with: {eval var=$sSupport.sFields[$sKey]... should be exchanged with the following:
{$sSupport.sFields[$sKey]|replace:'{literal}':''|replace:'{/literal}':''|replace:'%*%':"{s name='RequiredField' namespace='frontend/register/index'}{/s}"}
Which versions are affected by GHSA-7336-ghhp-f2qj?
2 open source packages ship an affected version, including shopware/shopware.
| Package | Affected | Fixed in |
|---|---|---|
shopware/shopware Packagist | From 5.2.15 | 5.2.16 |
shopware/shopware Packagist | From 5.2.15 | 5.2.16 |
How do I fix GHSA-7336-ghhp-f2qj?
Upgrade shopware/shopware to 5.2.16 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-7336-ghhp-f2qj being exploited?
There is no known exploitation of GHSA-7336-ghhp-f2qj in the wild and no public exploit code.